10

I'm hardening an Ubuntu 14.04 VM to CIS standards and am having a problems getting rsyslog to create the necessary files.

Note: I'm getting better with Linux but I'm no master yet, please excuse any ignorance.

I inserted a file /etc/rsyslog.d/CIS.conf with the following contents:

*.emerg :omusrmsg:*
mail.* -/var/log/mail
mail.info -/var/log/mail.info
mail.warning -/var/log/mail.warn
mail.err /var/log/mail.err
news.crit -/var/log/news/news.crit
news.err -/var/log/news/news.err
news.notice -/var/log/news/news.notice
*.=warning;*.=err -/var/log/warn
*.crit /var/log/warn
*.*;mail.none;news.none -/var/log/messages
local0,local1.* -/var/log/localmessages
local2,local3.* -/var/log/localmessages
local4,local5.* -/var/log/localmessages
local6,local7.* -/var/log/localmessages

I also modified /etc/rysyslog.conf. The contents are thus:

$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog   # provides kernel logging support

$KLogPermitNonKernelFacility on

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

$RepeatedMsgReduction on

$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog

$WorkDirectory /var/spool/rsyslog

$IncludeConfig /etc/rsyslog.d/*.conf

the repeating contents of /var/log/syslog is:

Apr  6 10:03:10 ubuntu rsyslogd-2039: Could no open output pipe '/dev/xconsole': No such file or directory [try http://www.rsyslog.com/e/2039 ]
Apr  6 10:15:17 ubuntu rsyslogd: [origin software="rsyslogd" swVersion="7.4.4" x-pid="3074" x-info="http://www.rsyslog.com"] exiting on signal 15.
Apr  6 10:15:17 ubuntu rsyslogd: [origin software="rsyslogd" swVersion="7.4.4" x-pid="3152" x-info="http://www.rsyslog.com"] start
Apr  6 10:15:17 ubuntu rsyslogd: rsyslogd's groupid changed to 104
Apr  6 10:15:17 ubuntu rsyslogd: rsyslogd's userid changed to 101

I tried commenting out the xconsole line in /etc/rsyslog.d/50-default.conf and then restarting rsyslog. After doing that, I now don't see any xconsole errors appearing.

What else can I do to try to pinpoint why rsyslog isn't creating these files?

Thanks!

Improve this question
4
  • not sure about rsyslog, but classic syslog used to refuse to create the initial file; you'd have to touch it first. rsyslog may be doing the same thing, and/or may have a behavior flag/switch that allows it to create the file.
    – Jeff Schaller ♦
    Commented Apr 7, 2016 at 16:33
  • maybe this is a different "rsyslogd" but linux.die.net/man/5/rsyslog.conf says that the file path should start with a "/" -- yours have a hyphen in front. Does removing the hypen help any?
    – Jeff Schaller ♦
    Commented Apr 7, 2016 at 17:09
  • rsyslog.com/doc/v8-stable/compatibility/… says more about this. Not sure what exactly "if rsyslogd finds sync selector lines, it ignores them by default" means - if it ignores the hyphen or ignores the whole selector line.
    – Jeff Schaller ♦
    Commented Apr 7, 2016 at 17:12
  • I tested removing the - and it doesn't appear to work
    – JaReg
    Commented Apr 7, 2016 at 17:14

2 Answers 2

Reset to default
10

Create /dev/xconsole and set its correct ownership and permissions:

sudo touch /dev/xconsole
sudo chgrp syslog /dev/xconsole
sudo chmod 664 /dev/xconsole

Restart the rsyslog service as follows:

Ubuntu 14.04

sudo service rsyslog restart

Ubuntu 16.04 and later, using systemd

sudo systemctl restart rsyslog

Verify the error message no longer appears:

tail -n100 /var/log/syslog | grep rsyslog
Improve this answer
1
  • No, /dev/xconsole is not a regular file, you need mknod to create it mknod -m 640 /dev/xconsole p will do the trick
    – fraff
    Commented May 20, 2021 at 9:16
0

May be it is a permission issue to the /dev/xconsole folder. Try using chmod to change permission and restart it. It might work.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .